Category:Amlogic

Amlogic Incorporated

Amlogic
Name	Amlogic Incorporated
Country	USA / Worldwide
Industry	ARM
Resources	English homepage, Chinese homepage

Amlogic Incorporated, or Amlogic (sometimes AMLogic) is a chip maker company which has its headquarters in the USA. They mainly operate in China.

They mainly produce SoCs suitable for use in set top boxes running either AOSP or Android TV, but also produce SoCs used in televisions.

Discussion

There's an IRC channel hosted on the Libera.Chat IRC network by the linux-meson.com community:

• Network: irc.libera.chat
• Port: 6667 (plain) or 6697 (TLS, secure)
• Channel: #linux-amlogic

For anything postmarketOS-related on Amlogic, please use the postmarketOS channels and ping either User:FerassElHafidi (nick: f_) or User:Exkc (@exxxxkc:matrix.org).

Devices with an Amlogic SoC

Generic device ports

These devices are combined into generic ports. Refer to chipset when looking for your device.

Non-generic device ports

Other devices that are not combined into generic ports.

Supported SoCs

-H variant

There's also a -H variant of some Amlogic SoCs (like the S905X, S812, etc), which merely include Dolby licenses, but otherwise they're the same as the non-H counterparts.

Boot process

Generally, the boot ROM (=BL1) of Amlogic-based devices either boot to:

• SPI NOR
• eMMC
• NAND
• an SD card
• USB (via a custom protocol, please note that BL1 cannot boot from a USB stick)

Order depends on POC.

You can force them to boot from an SD card or USB (via Amlogic's in-house protocol) by using a HDMI dongle(There are seem a lot of clone of it for booting via USB in china). This is a suitable alternative for those who want to boot to an SD card without wiping everything else, and for devices that have a locked flash mode that would be bricked if the eMMC is wiped. Some devices e.g. Libre Computer AML-S905X-CC-V1.0 (librecomputer-lepotato) also have a button to enter USB mode or, in the case of the Libre Computer AML-S905D3-CC-V0.2 (librecomputer-solitude), have a switch to force eMMC/SD boot.

BL1 looks for an @AML header which contains multiple entries for BL2. The header roughly looks like this:

struct aml_hdr {
    /* before magic word: random bytes ignored by BL1 */
	uint32_t magic; /* "@AML" */
	uint32_t total_size; /* header+binary size */
	uint8_t header_size; /* header size */
	uint8_t root_key_index; /* amlogic secureboot-related */
	
    /* version */
    uint8_t version_major;
	uint8_t version_minor;
	uint32_t padding1;

    /* checksum */
	uint32_t digest_type;
	uint32_t digest_offset;
	uint32_t digest_size;

	uint32_t data_offset;

    /*
     * signing the BL2 image, 
     * this is completly ignored if secureboot isn't enabled
     */
	uint32_t key_type;
	uint32_t key_offset;
	uint32_t key_size;
	
    uint32_t data_size;
	uint32_t payload_type;
	uint32_t payload_offset;
	uint32_t payload_size;
	uint32_t padding2;
} __packed;

Depending on the SoC family, what happens before U-Boot runs may differ; refer to their respective SoC page.

U-Boot quirk in some set-top boxes

Most set-top boxes have U-Boot on the eMMC, which then (for some reason) looks for the following U-Boot scripts if a "multiboot" mode is triggered on either an SD card or a USB device (FAT32 boot partition!):

• aml_autoscript
• s905_autoscript
• s805_autoscript (if using an Amlogic S8XX SoC. Not packaged.)

If it doesn't find either ones, it'll boot to Android.

This is believed to be a quirk enabled by Amlogic themselves for their reference boards and since box manufacturers usually base their box on reference boards, including u-boot, it's possible that it has been unintentionally retained.

Triggering "multiboot" mode depends on the set-top box, but they generally have a button at the bottom or hidden inside the AV port. Press it while plugging in your power supply and it should work.

We use this quirk to load a mainline U-Boot and then boot postmarketOS (see soc-amlogic-s905^PMOS).

Sometimes, however, the "multiboot" mode isn't available on some devices or after some Android TV upgrades; that is the case for the Xiaomi Mi Box 3 (xiaomi-once), which doesn't have this feature unless you manually implement it in the U-Boot environment via the U-Boot shell (some devices might disable the U-Boot shell as well).

Flashing

Amlogic USB Burning tool

The Amlogic USB Burning tool is Amlogic's proprietary flashing software. It's used to flash Amlogic devices by using Amlogic's in-house protocol. It only works on Microsoft Windows.

There's also another proprietary CLI tool from Amlogic called update. It allows you to read the Amlogic SoC info, flash the firmware, temporarily boot firmware (u-boot) (just like fastboot boot boot.img), extract the firmware and lock the flash mode with a password in the flash mode. It has a Microsoft Windows version and a GNU+Linux version.

That software is built with an old toolchain and most binaries are x86-only.

Some other software is built around this CLI tool such as aml-linux-usb-burn, aml-usb-load-uboot and aml-flash-tool

aml-flash-tool bundles an ARM build of the CLI tool.

pyamlboot

pyamlboot is an effort to reverse-engineer Amlogic's custom USB boot protocol. It allows you to boot any binary you want (depending on the device). Instructions on how to use it can be found on the GitHub page linked below.

See also

• Linux and U-Boot mainlining status
• Boot into flashing mode with a HDMI dongle
• pyamlboot
• Port Amlogic-based set top boxes
• Boot flow
• Efforts to reverse-engineer Amlogic's proprietary utils (those utilities are used above to create a working FIP)
• Reversing BL2